CVE-2025-8132

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been rated as critical. Affected by this issue is the function delfile of the file app/extend/utils.js. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. The name of the patch is c8a282bf02a62b59ec60b4699e91c51aff2ee9cd. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
yanyutao0402	ChanCMS	3.1.0; 3.1.1; 3.1.2

References

https://gitee.com/yanyutao0402/ChanCMS/commit/c8a282bf02a62b59ec60b4699e91c51aff2ee9cdPermissions Required
https://gitee.com/yanyutao0402/ChanCMS/issues/ICLOT8Exploit, Issue Tracking
https://gitee.com/yanyutao0402/ChanCMS/issues/ICLOT8#note_43945209_linkExploit, Issue Tracking
https://gitee.com/yanyutao0402/ChanCMS/releases/tag/V3.1.3Release Notes
https://vuldb.com/?ctiid.317528Permissions Required, VDB Entry
https://vuldb.com/?id.317528Third Party Advisory, VDB Entry
https://vuldb.com/?submit.619776Third Party Advisory, VDB Entry
https://gitee.com/yanyutao0402/ChanCMS/issues/ICLOT8Exploit, Issue Tracking
https://gitee.com/yanyutao0402/ChanCMS/issues/ICLOT8#note_43945209_linkExploit, Issue Tracking

Timeline

Published: Jul 25, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-81336.3A vulnerability classified as critical has been found in yanyutao0402 ChanCMS up to 3.1.2. This affects the function getArticle of the file CVE-2025-81348.8A vulnerability classified as critical was found in PHPGurukul BP Monitoring Management System 1.0. This vulnerability affects unknown code CVE-2025-81358.8A vulnerability, which was classified as critical, has been found in itsourcecode Insurance Management System 1.0. This issue affects some u CVE-2025-81367.5A vulnerability, which was classified as critical, was found in TOTOLINK A702R 4.0.0-B20230721.1521. Affected is an unknown function of the CVE-2025-81378.8A vulnerability has been found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. Affected by this vulnerability is an unkno CVE-2025-81388.8A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. Affected by this issue is some unknown function CVE-2025-81398.8A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been classified as critical. This affects an unknown part of the fi CVE-2025-81408.8A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been declared as critical. This vulnerability affects unknown code CVE-2025-81418.8The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in CVE-2025-81428.8The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.6.7 via the 'header_layout' pa CVE-2025-81436.4The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pcsml_smartlists_h’ parameter in all versions up to, a CVE-2025-81458.8The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 vi